sentenza has quit [Remote host closed the connection]
gursewak has joined #fedora-coreos
jkonecny[m] has joined #fedora-coreos
<jkonecny[m]>
Hi everyone, could someone please share with me what is the firewall status on FCOS? IIRC nftables is the recommended way, which is fine for me. However, I'm missing official guide, tips and tricks etc... I'm not firewall expert but I would like to use FCOS on my server and I would like to do it correctly.
<jkonecny[m]>
Could someone here please guide me.
<jkonecny[m]>
Right now I have a working configuration but I'm still confused how to correctly work with podman port forwarding in NFT
jpn has joined #fedora-coreos
c4rt0 has joined #fedora-coreos
jpn has quit [Ping timeout: 246 seconds]
jpn has joined #fedora-coreos
gursewak has quit [Ping timeout: 260 seconds]
paragan has quit [Quit: Leaving]
<travier[m]>
jkonecny: See https://github.com/coreos/fedora-coreos-tracker/issues/467. We don't do anything specific in FCOS regarding firewall setup so that's more of a podman question on how to do things via nftables that interacts well with how podman works
<jkonecny[m]>
travier: it is podman question but I'm convinced that it should be documented and easily understandable here https://docs.fedoraproject.org/en-US/fedora-coreos/ -- especially if you want to promote CoreOS as recommended solution for home servers
<dustymabe>
jlebon: maybe there's some nuance there that I'm not fully remembering
<dustymabe>
it's been a while since I opened that PR
<jlebon>
dustymabe: IIUC, that PR is to handle the case where network kargs are forwarded via the firstboot-network-kargs hack, but no-ops based on kargs already on disk in the BLS should work
<jlebon>
and since coreos-installer's --append-karg changes the BLS itself, that should work
<dustymabe>
ok, yeah I need to dig into it again
<jlebon>
+1
<dustymabe>
jlebon: it looks like quay has been a little less reliable recently. seeing issues running the build-cosa job lately
<dustymabe>
it seems like it just takes a long time for the tag to show up when querying the registry
<dustymabe>
I guess the problem could be on the `podman push` side too
<jlebon>
dustymabe: if it eventually did show up, maybe we can just bump the timeout for now?
<dustymabe>
jlebon: that's the thing. I see it in quay (web interface)
<dustymabe>
i wonder if somehow podman is caching results
<dustymabe>
nope.. podman search --list-tags quay.io/coreos-assembler/staging --- doesn't show the tag